k8s-security-policies

Implement Kubernetes security policies including NetworkPolicy, PodSecurityPolicy, and RBAC for production-grade security. Use when securing Kubernetes clusters, implementing network isolation, or enforcing pod security standards.

1.21x

Quality

80%

Does it follow best practices?

Impact

95%

1.21x

Average score across 3 eval scenarios

Securityby

Passed

No findings from the security scan

Fix and improve this skill with Tessl

tessl review fix ./tests/ext_conformance/artifacts/agents-wshobson/kubernetes-operations/skills/k8s-security-policies/SKILL.md

The canonical home for this skill is k8s-security-policies in wshobson/agents

Quality

Content

72%Weight 40%Scale 1-5

Reviews the quality of instructions and guidance provided to agents. Good implementation is clear, handles edge cases, and produces reliable results.

A highly actionable catalog of executable Kubernetes security manifests, weakened by a lack of sequenced validation workflows and by progressive-disclosure issues (inline duplication of bundle content and a broken reference path).

Suggestions

Add a short sequenced workflow with validation checkpoints (e.g., apply policy -> `kubectl get networkpolicy` -> verify isolation with a test pod -> only then proceed), since applying cluster security policies is a destructive/batch operation.

Remove or create the missing `assets/pod-security-template.yaml` referenced in the "Reference Files" section, and move the inline NetworkPolicy/RBAC manifests that duplicate `assets/network-policy-template.yaml` and `references/rbac-patterns.md` into those bundle files with brief inline pointers.

Trim the "Best Practices" and "Compliance Frameworks" sections, which restate configuration already shown as concrete YAML, to reduce token cost.

Dimension	Reasoning	Score
Conciseness	The body is dominated by lean, copy-paste YAML with no preamble explaining concepts Claude already knows, though the "Best Practices" and "Compliance Frameworks" sections restate ideas already demonstrated and could be trimmed.	4 / 5
Actionability	Provides fully executable, copy-paste-ready manifests covering the common cases (default-deny, frontend-to-backend, DNS, RBAC role/binding, restricted pod, Gatekeeper, Istio mTLS) plus concrete kubectl troubleshooting commands.	5 / 5
Workflow Clarity	Content is organized by topic rather than as a sequenced workflow, and applying security policies to a production cluster is a destructive/batch operation with no validation checkpoints (e.g., verify policy applied, test isolation), capping this dimension at 3.	3 / 5
Progressive Disclosure	Structure and signaled one-level-deep references exist, but large blocks of inline manifests duplicate content that already lives in bundle files, and the "Reference Files" section lists `assets/pod-security-template.yaml` which does not exist in the bundle.	3 / 5
	Total	15 / 20 Passed

Description

87%Weight 40%Scale 1-5

Based on the skill's description, can an agent find and select it at the right time? Clear, specific descriptions lead to better discovery.

A strong, well-structured description that clearly states both capability and trigger conditions with concrete, domain-specific language. Minor gains are possible by adding a few more synonyms or file extensions to the trigger list.

Dimension	Reasoning	Score
Specificity	Names the domain and several concrete policy types ("NetworkPolicy, PodSecurityPolicy, and RBAC") but describes them as components to implement rather than enumerating a comprehensive set of distinct actions, leaving minor coverage gaps.	4 / 5
Completeness	Explicitly answers both what ("Implement Kubernetes security policies including NetworkPolicy, PodSecurityPolicy, and RBAC") and when ("Use when securing Kubernetes clusters, implementing network isolation, or enforcing pod security standards") with concrete trigger phrases.	5 / 5
Trigger Term Quality	Includes natural phrases a user would say ("securing Kubernetes clusters", "network isolation", "pod security standards") with good coverage, though a few synonyms or extensions are missing.	4 / 5
Distinctiveness Conflict Risk	Occupies a clear Kubernetes-security niche with distinct triggers, and the security-focused phrasing minimizes overlap with adjacent skills like manifest generation.	5 / 5
	Total	18 / 20 Passed

Validation

93%

Warnings & errors only

Checks the skill against the spec for correct structure and formatting. All validation checks must pass before discovery and implementation can be scored.

Validation — 15 / 16 Passed

Validation for skill structure

Criteria	Description	Result
referenced_paths_exist	Referenced path issues: 1 missing	Warning

	Total	15 / 16 Passed

Repository: Dicklesworthstone/pi_agent_rust
Path: tests/ext_conformance/artifacts/agents-wshobson/kubernetes-operations/skills/k8s-security-policies/SKILL.md
Commit: 6453c0b

Reviewed: about 8 hours ago

Table of Contents

Discovery Implementation Validation

Is this your skill?

If you maintain this skill, you can claim it as your own. Once claimed, you can manage eval scenarios, bundle related skills, attach documentation or rules, and ensure cross-agent compatibility.